• Log in to the AWS console using the Root Credentials
• Verify the AWS Organizations
• The AWS Organization should be having a minimum of 1 Master Account and 1 Member Account 

The Master Account 

 The Master account must be having the below policies attached for the "Amazon AWS Organization" to identify.

• DescribeOrganization
• DescribeAccount
• DescribeListAccounts

 If the above policy actions are not available on the  AWS Account, the account is treated as regular account but  not as the Master Account

Manually add the Policies to the Account 

• Log in to the Account which would you like to make as master 
• AWS Services >> IAM >> Policies >> Create Policy 
  
  
  • Services: Choose "Organization" and "Accounts"
  • Resources: Account, Handshake, OrganizationalUnit, Policy and mark them for Any
    
• Review Policy
  
• Provide a Policy name and Create the Policy
• Attach the policy to the Account  

Verify if the Accounts are Master or Member Account 

• AWS Services >> IAM >> Organization Activity  
• The Root will be having a list of the Accounts and some are marked as Master 

Create User and Associate Policy on Master Account 

• AWS Services >> IAM >> Users >> Create User (We can also use the Existing users)
• While creating the user the Access Type check for "Programmatic Access"

Set Permissions to the user 

• Choose "Attach Existing Policies"
• Create Policy >> Choose the Below 
• Service: STS 
• Under STS >> Write >> Select the Assume Role 

Set the ARN at the Resources (Visual Editor)

• Select Resource: Specific (Not All)
• Click on "Add ARN"
• The Page will open to add the ARN for 
• Account: >>>> Provide the "Member Account ID"
• Role name with path: >>>> Provide the "OrganizationAccountAccessRole"

Set the ARN at the Resources (JSON)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::<Member Account ID>:role/OrganizationAccountAccessRole"
        }
    ]
}

Add Policy to the User

• Add "ReadOnly" and the Newly created Policy to the User
• Administrator Access not needed

Verify the Summary of the User  

• Copy the User ARN which needed to be updated in